Dumping Bootldr

Requirements

• OtherOS++ with SS Patches
• Linux Kernel with glevand's/graf's patches (red ribbon rc6 will do the trick, since it has the embedded kernel)
• [the exploit] / [version ports]
• NOR console with a NOR dump (the exploit isn't adapted to NAND consoles yet, no MMIO available)

How to

1. Start a normal session from red ribbon (or any other distro you might have)
2. Extract the contents of bootldrexploit to your home folder
3. Open your terminal and type as root:


cd bootldrexploit/ps3peekpoke

4. Compile the lv1 peek poke kernel module:


make

5. Insert the lv1 peek poke kernel module:


insmod ps3peekpoke.ko

6. Change directory to the exploit dir


cd ../btldr8

7. Compile the exploit


make

8. Make a nor dump by typing


dd if=/dev/ps3nflasha of=nor.bin bs=1024

9. Execute the exploit


./lv0Decrypt 0 nor.bin buffer.bin

10. It should show the status as status A0082. This means you've succeeded. check your dump for the keys.


hexdump -C dump.bin > test



nano test

Notes

• for the latest version of red ribbon, don't forget to also change dir to /usr/src/[your linux headers folder]/ and type make modules_prepare

• in the eventual case you get status 89 no matter what you do, replace the function writeResponsePackageChecksum with this one : http://pastie.org/private/fyirapl8w78j462ggxmsyw